CVE-2026-1761 | Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction.

Published: 2026-02-02 Last update: 2026-04-15 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2026-1761 is rated Moderate Risk (62.4/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.26%). Mandatory action: Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-1761

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-04 1.17% 1.26% +0.09%
2 2026-04-11 1.40% 1.17% -0.23%
3 2026-03-06 1.40%

Full EPSS history (9 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-1761

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
8.6 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.
3.9 4.7 [email protected]

Weakness enumeration for CVE-2026-1761

OS Trackers for CVE-2026-1761

vendor priority summary link
debian not yet assigned CVE-2026-1761 not yet assigned priority: Debian including 2 source packages (libsoup2.4, libsoup3), 7 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 5, resolved 2. https://security-tracker.debian.org/tracker/CVE-2026-1761
redhat high https://access.redhat.com/security/cve/CVE-2026-1761
suse high CVE-2026-1761 severity important: SUSE including 68 source package names (2.1.3-4.14:libefivar1-38-3.1, libefivar1-38-3.1, …), 306 product×package rows across 57 product lines (Container suse/sl-micro/6.0/base-os-container, Image SL-Micro, … (57 product lines)): Fixed 302, First Fixed 4. https://www.suse.com/security/cve/CVE-2026-1761/
ubuntu medium CVE-2026-1761 medium priority: Ubuntu including 2 source packages (libsoup2.4, libsoup3), 11 status rows across 7 suites (bionic, focal, jammy, noble, questing, upstream, xenial): needs-triage 10, released 1. https://ubuntu.com/security/CVE-2026-1761

Affected software / configurations for CVE-2026-1761

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2026-1761

URL Tags
https://access.redhat.com/errata/RHSA-2026:1948
https://access.redhat.com/errata/RHSA-2026:2005
https://access.redhat.com/errata/RHSA-2026:2006
https://access.redhat.com/errata/RHSA-2026:2007
https://access.redhat.com/errata/RHSA-2026:2008
https://access.redhat.com/errata/RHSA-2026:2049
https://access.redhat.com/errata/RHSA-2026:2182
https://access.redhat.com/errata/RHSA-2026:2214
https://access.redhat.com/errata/RHSA-2026:2215
https://access.redhat.com/errata/RHSA-2026:2216
https://access.redhat.com/errata/RHSA-2026:2396
https://access.redhat.com/errata/RHSA-2026:2402
https://access.redhat.com/errata/RHSA-2026:2410
https://access.redhat.com/errata/RHSA-2026:2512
https://access.redhat.com/errata/RHSA-2026:2513
https://access.redhat.com/errata/RHSA-2026:2514
https://access.redhat.com/errata/RHSA-2026:2528
https://access.redhat.com/errata/RHSA-2026:2529
https://access.redhat.com/errata/RHSA-2026:2628
https://access.redhat.com/errata/RHSA-2026:2844
https://access.redhat.com/security/cve/CVE-2026-1761
https://bugzilla.redhat.com/show_bug.cgi?id=2435961
https://gitlab.gnome.org/GNOME/libsoup/-/issues/493
cvelogic Threat Intelligence